1 #ifndef IPTABLES_XSHARED_H 2 #define IPTABLES_XSHARED_H 1 3 4 #include <limits.h> 5 #include <stdbool.h> 6 #include <stdint.h> 7 #include <netinet/in.h> 8 #include <net/if.h> 9 #include <sys/time.h> 10 #include <linux/netfilter_arp/arp_tables.h> 11 #include <linux/netfilter_ipv4/ip_tables.h> 12 #include <linux/netfilter_ipv6/ip6_tables.h> 13 14 #ifdef DEBUG 15 #define DEBUGP(x, args...) fprintf(stderr, x, ## args) 16 #else 17 #define DEBUGP(x, args...) 18 #endif 19 20 enum { 21 OPT_NONE = 0, 22 OPT_NUMERIC = 1 << 0, 23 OPT_SOURCE = 1 << 1, 24 OPT_DESTINATION = 1 << 2, 25 OPT_PROTOCOL = 1 << 3, 26 OPT_JUMP = 1 << 4, 27 OPT_VERBOSE = 1 << 5, 28 OPT_EXPANDED = 1 << 6, 29 OPT_VIANAMEIN = 1 << 7, 30 OPT_VIANAMEOUT = 1 << 8, 31 OPT_LINENUMBERS = 1 << 9, 32 OPT_COUNTERS = 1 << 10, 33 /* below are for arptables only */ 34 OPT_S_MAC = 1 << 11, 35 OPT_D_MAC = 1 << 12, 36 OPT_H_LENGTH = 1 << 13, 37 OPT_OPCODE = 1 << 14, 38 OPT_H_TYPE = 1 << 15, 39 OPT_P_TYPE = 1 << 16, 40 }; 41 42 enum { 43 CMD_NONE = 0, 44 CMD_INSERT = 1 << 0, 45 CMD_DELETE = 1 << 1, 46 CMD_DELETE_NUM = 1 << 2, 47 CMD_REPLACE = 1 << 3, 48 CMD_APPEND = 1 << 4, 49 CMD_LIST = 1 << 5, 50 CMD_FLUSH = 1 << 6, 51 CMD_ZERO = 1 << 7, 52 CMD_NEW_CHAIN = 1 << 8, 53 CMD_DELETE_CHAIN = 1 << 9, 54 CMD_SET_POLICY = 1 << 10, 55 CMD_RENAME_CHAIN = 1 << 11, 56 CMD_LIST_RULES = 1 << 12, 57 CMD_ZERO_NUM = 1 << 13, 58 CMD_CHECK = 1 << 14, 59 }; 60 #define NUMBER_OF_CMD 16 61 62 struct xtables_globals; 63 struct xtables_rule_match; 64 struct xtables_target; 65 66 /** 67 * xtables_afinfo - protocol family dependent information 68 * @kmod: kernel module basename (e.g. "ip_tables") 69 * @proc_exists: file which exists in procfs when module already loaded 70 * @libprefix: prefix of .so library name (e.g. "libipt_") 71 * @family: nfproto family 72 * @ipproto: used by setsockopt (e.g. IPPROTO_IP) 73 * @so_rev_match: optname to check revision support of match 74 * @so_rev_target: optname to check revision support of target 75 */ 76 struct xtables_afinfo { 77 const char *kmod; 78 const char *proc_exists; 79 const char *libprefix; 80 uint8_t family; 81 uint8_t ipproto; 82 int so_rev_match; 83 int so_rev_target; 84 }; 85 86 /* trick for ebtables-compat, since watchers are targets */ 87 struct ebt_match { 88 struct ebt_match *next; 89 union { 90 struct xtables_match *match; 91 struct xtables_target *watcher; 92 } u; 93 bool ismatch; 94 }; 95 96 /* Fake ebt_entry */ 97 struct ebt_entry { 98 /* this needs to be the first field */ 99 unsigned int bitmask; 100 unsigned int invflags; 101 uint16_t ethproto; 102 /* the physical in-dev */ 103 char in[IFNAMSIZ]; 104 /* the logical in-dev */ 105 char logical_in[IFNAMSIZ]; 106 /* the physical out-dev */ 107 char out[IFNAMSIZ]; 108 /* the logical out-dev */ 109 char logical_out[IFNAMSIZ]; 110 unsigned char sourcemac[6]; 111 unsigned char sourcemsk[6]; 112 unsigned char destmac[6]; 113 unsigned char destmsk[6]; 114 }; 115 116 struct iptables_command_state { 117 union { 118 struct ebt_entry eb; 119 struct ipt_entry fw; 120 struct ip6t_entry fw6; 121 struct arpt_entry arp; 122 }; 123 int invert; 124 int c; 125 unsigned int options; 126 struct xtables_rule_match *matches; 127 struct ebt_match *match_list; 128 struct xtables_target *target; 129 struct xt_counters counters; 130 char *protocol; 131 int proto_used; 132 const char *jumpto; 133 char **argv; 134 bool restore; 135 }; 136 137 typedef int (*mainfunc_t)(int, char **); 138 139 struct subcommand { 140 const char *name; 141 mainfunc_t main; 142 }; 143 144 enum { 145 XT_OPTION_OFFSET_SCALE = 256, 146 }; 147 148 extern void print_extension_helps(const struct xtables_target *, 149 const struct xtables_rule_match *); 150 extern const char *proto_to_name(uint8_t, int); 151 extern int command_default(struct iptables_command_state *, 152 struct xtables_globals *); 153 extern struct xtables_match *load_proto(struct iptables_command_state *); 154 extern int subcmd_main(int, char **, const struct subcommand *); 155 extern void xs_init_target(struct xtables_target *); 156 extern void xs_init_match(struct xtables_match *); 157 158 /** 159 * Values for the iptables lock. 160 * 161 * A value >= 0 indicates the lock filedescriptor. Other values are: 162 * 163 * XT_LOCK_FAILED : The lock could not be acquired. 164 * 165 * XT_LOCK_BUSY : The lock was held by another process. xtables_lock only 166 * returns this value when |wait| == false. If |wait| == true, xtables_lock 167 * will not return unless the lock has been acquired. 168 * 169 * XT_LOCK_NOT_ACQUIRED : We have not yet attempted to acquire the lock. 170 */ 171 enum { 172 XT_LOCK_BUSY = -1, 173 XT_LOCK_FAILED = -2, 174 XT_LOCK_NOT_ACQUIRED = -3, 175 }; 176 extern void xtables_unlock(int lock); 177 extern int xtables_lock_or_exit(int wait, struct timeval *tv); 178 179 int parse_wait_time(int argc, char *argv[]); 180 void parse_wait_interval(int argc, char *argv[], struct timeval *wait_interval); 181 int parse_counters(const char *string, struct xt_counters *ctr); 182 bool tokenize_rule_counters(char **bufferp, char **pcnt, char **bcnt, int line); 183 bool xs_has_arg(int argc, char *argv[]); 184 185 extern const struct xtables_afinfo *afinfo; 186 187 #define MAX_ARGC 255 188 struct argv_store { 189 int argc; 190 char *argv[MAX_ARGC]; 191 int argvattr[MAX_ARGC]; 192 }; 193 194 void add_argv(struct argv_store *store, const char *what, int quoted); 195 void free_argv(struct argv_store *store); 196 void save_argv(struct argv_store *dst, struct argv_store *src); 197 void add_param_to_argv(struct argv_store *store, char *parsestart, int line); 198 #ifdef DEBUG 199 void debug_print_argv(struct argv_store *store); 200 #else 201 # define debug_print_argv(...) /* nothing */ 202 #endif 203 204 void print_ipv4_addresses(const struct ipt_entry *fw, unsigned int format); 205 void print_ipv6_addresses(const struct ip6t_entry *fw6, unsigned int format); 206 207 void print_ifaces(const char *iniface, const char *outiface, uint8_t invflags, 208 unsigned int format); 209 210 void command_match(struct iptables_command_state *cs); 211 const char *xt_parse_target(const char *targetname); 212 void command_jump(struct iptables_command_state *cs, const char *jumpto); 213 214 char cmd2char(int option); 215 void add_command(unsigned int *cmd, const int newcmd, 216 const int othercmds, int invert); 217 int parse_rulenumber(const char *rule); 218 219 #endif /* IPTABLES_XSHARED_H */ 220